feat(commercial-v1-ga): sync working-tree changes for v1 GA#24
Conversation
Add update_check module with tests, email_outbox retention tests, and LLM config tests. Refine billing, config, service, app, dashboard_app, mcp_server, v2_api, license_cloud, llm/client, email_outbox, and inspector. Update dashboard UI (css/js/index.html), conftest, and .env.example.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f5b76052e8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return override | ||
| db = os.environ.get("ENGRAPHIS_DB_PATH", "").strip() | ||
| if db and db != ":memory:": | ||
| if not vendor_mode and db and db != ":memory:": |
There was a problem hiding this comment.
In vendor mode this newly ignores ENGRAPHIS_DB_PATH, even though prior releases used its sibling .engraphis_webhooks.db when ENGRAPHIS_WEBHOOK_STATE was unset. Thus an existing vendor deployment with ENGRAPHIS_DB_PATH (and, for example, ENGRAPHIS_RELAY_DB) but no explicit webhook-state setting begins using a fresh polar-webhooks.db after upgrade, losing all webhook idempotency and subscription-seat baselines; replayed Polar events can then be fulfilled again. It also diverges from scripts/commercial_backup.py:115-126 and inspector/webhooks.py:819-834, which still select the DB-path directory first, so backups/manual-fulfillment state no longer cover the ledger actually used by billing.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a337091e55
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| c.execute("DELETE FROM edge_supports WHERE edge_id=?", (ed["id"],)) | ||
| c.execute("DELETE FROM edges WHERE id=?", (ed["id"],)) |
There was a problem hiding this comment.
When a workspace merge finds an equivalent live target edge, this path moves support rows and deletes the source edge but never combines the source edge's weight or provenance. Thus, if the source relation has a higher manual weight or unique provenance, merging silently keeps the target's weaker relation and discards the source audit context; this differs from Store._deduplicate_live_edges(), which takes the maximum weight and merges provenance before retiring duplicates.
Useful? React with 👍 / 👎.
…ore-floor CI
The core floor job (numpy-only, Python 3.9) does not install fastapi.
tests/test_update_check.py::test_api_update_endpoint and
test_api_update_never_raises import engraphis.routes.v2_api which
requires fastapi at module level, causing ModuleNotFoundError in that
job. Add pytest.importorskip("fastapi") inside each test so they skip
gracefully when fastapi is absent while the remaining 34 update_check
tests still run.
… in memories endpoint
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa0fdd1762
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "UPDATE email_outbox SET status='sent',provider=?,provider_message_id=?," | ||
| "last_error='',sent_at=?,updated_at=? " | ||
| "last_error='',sent_at=?,updated_at=?,text_body='',reply_to=NULL " | ||
| "WHERE id=? AND status='sending' AND attempts=?", |
There was a problem hiding this comment.
Clearing text_body after a successful provider send removes the only durable copy of a purchased license key. If the process crashes after deliver_now() succeeds but before the Polar fulfillment claim is finalized, the redelivered event enters inspector/webhooks.py::_existing_license_delivery(), finds this same idempotency row with an empty body, and raises durable purchase email is missing its signed key instead of converging on the original fulfillment. That leaves the webhook retryable but permanently unable to finalize unless an operator intervenes; retain the key in an appropriately protected recovery record until the fulfillment is finalized.
Useful? React with 👍 / 👎.
…dge merge) billing.py (P1) — Preserve the existing vendor webhook ledger path. _dedup_path() no longer skips ENGRAPHIS_DB_PATH in vendor mode. Reverting the `not vendor_mode` guard restores selection of the sibling .engraphis_webhooks.db when ENGRAPHIS_WEBHOOK_STATE is unset, so an existing vendor deployment keeps its webhook idempotency and subscription-seat baselines instead of silently switching to a fresh polar-webhooks.db (which would allow replayed Polar events to be fulfilled again). Realigns billing with scripts/commercial_backup.py and inspector/webhooks.py, which select the DB-path directory first. service.py (P2) — Preserve edge metadata when merging a collision. merge_workspaces() now folds the source edge's weight (max) and provenance into the surviving live target edge before deleting the duplicate, mirroring Store._deduplicate_live_edges(). Previously a higher manual weight or unique provenance/audit context on the source relation was silently discarded.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c8c948b44
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| merged_ids=[ed["id"]], | ||
| ) | ||
| c.execute( | ||
| "UPDATE edges SET weight=?, provenance=? WHERE id=?", |
There was a problem hiding this comment.
When both workspaces contain the same live relation and the source edge predates the target edge, this collision path deletes the source while retaining the target's valid_from and ingested_at. That makes the merged graph report the relation as newer than it actually is and changes time-travel graph results; unlike Store._deduplicate_live_edges(), merge the earliest timestamps from both edges into the survivor along with weight and provenance.
Useful? React with 👍 / 👎.
…, P2 edge timestamps) P1 email_outbox.deliver_now: clearing text_body/reply_to on a successful send destroyed the only durable copy of a purchased license key. A crash after send but before the Polar fulfillment claim finalized then left inspector/webhooks.py::_existing_license_delivery() reading an empty body and raising "durable purchase email is missing its signed key", stranding the webhook as retryable-but-un-finalizable. Retain the recovery record for license-key-bearing bodies (the documented source of truth) and keep redacting non-recoverable bodies. Adds _body_has_license_key(), mirroring the recovery extractor. P2 service.merge_workspaces edge collision: the survivor kept the target's valid_from/ingested_at, so folding an older source relation reported it as newer than reality and skewed time-travel graph results. Carry the earliest valid_from and ingested_at into the survivor, mirroring Store._deduplicate_live_edges(). (weight-max + provenance-merge were already addressed in 7c8c948; the older "never combines weight or provenance" review note is resolved by that commit.) Verified via standalone sqlite sims (earliest-timestamp incl. null handling; both redact branches: license retained, non-license cleared), _body_has_license_key unit checks, py_compile, and no new >100-char lines.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c08a73d50e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # dropped in; everything never touched by drag-to-reorder falls back to recency. | ||
| sql += " ORDER BY (sort_order IS NULL), sort_order ASC, COALESCE(last_access, valid_from) DESC LIMIT ?" | ||
| args.append(max(1, min(1000, int(limit)))) | ||
| rows = conn.execute(sql, args).fetchall() |
There was a problem hiding this comment.
When dashboard requests overlap writes, this bypasses Store's serialized read path: execute() releases _SerializedConnection's lock before the returned cursor is consumed, so another request can begin a multi-statement transaction before fetchall() runs. The response can then read on the shared connection while that transaction is still in progress (including uncommitted state that may later roll back). Use the wrapper's atomic conn.fetchall(sql, args) path (and likewise avoid retaining the workspace lookup cursor) rather than fetching from cursors returned by execute() here.
Useful? React with 👍 / 👎.
| @mcp.tool( | ||
| name="engraphis_check_update", | ||
| annotations={"title": "Check for an Engraphis update", "readOnlyHint": True, | ||
| "destructiveHint": False, "idempotentHint": True, "openWorldHint": True}, | ||
| ) | ||
| def engraphis_check_update( | ||
| force: Annotated[bool, Field(description="Bypass the ~24h cache and re-check the " | ||
| "release source now.")] = False, | ||
| ) -> str: |
There was a problem hiding this comment.
This adds engraphis_check_update, but the shipped skill still says there are 28 tools and omits it from both skills/engraphis-memory/SKILL.md and skills/engraphis-memory/references/TOOLS.md; README and integration docs likewise advertise 28. This violates the AGENTS.md §7 requirement to keep the portable skill's tool names and parameters synchronized with mcp_server.py, leaving MCP clients and agents unable to discover the new supported capability.
Useful? React with 👍 / 👎.
|
Automated review: CI green (8/8 checks pass). Large sync PR (21 files): update-check feature, LLM auto-extract default OFF, email outbox license-key preservation, workspace merge edge dedup, Google API key header fix, memories endpoint refactor. No security issues found. Ready for human approval. |
…ad-only connection for /memories
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7cc59883b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| redact_sql = ( | ||
| "" if _body_has_license_key(message["text_body"]) | ||
| else ",text_body='',reply_to=NULL") |
There was a problem hiding this comment.
For every normal purchase_license email, inspector/webhooks.py::_license_email_text() places the signed key on its own indented line, so this predicate is true and the successful-send update deliberately leaves text_body intact. There is no subsequent outbox cleanup or fulfillment-finalization path in this commit—_existing_license_delivery() only reads the body—so all successfully delivered customer license keys now remain as plaintext in the vendor ledger indefinitely, whereas they were previously redacted after delivery. Retain recovery material only through the webhook finalization window (or in a protected recovery record), then clear it.
Useful? React with 👍 / 👎.
Council Merge Gate — BLOCKED BY BRANCH PROTECTIONDecision: APPROVE (pending council infrastructure fix) Evidence reviewed
Note
Action required
Posted by council merge gate cron (2026-07-21) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91c96c2ad5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| host = rest.split("/", 1)[0].split("@")[-1].split(":", 1)[0].lower() | ||
| loopback = host in ("localhost", "127.0.0.1", "::1", "[::1]") | ||
| if scheme != "https" and not (scheme == "http" and loopback): |
There was a problem hiding this comment.
When ENGRAPHIS_UPDATE_URL points to an IPv6 local mirror such as http://[::1]:8080/latest, splitting the authority at the first colon makes host equal to [ rather than ::1. The loopback check then rejects the URL before making the request, so the documented loopback-HTTP exception cannot work for IPv6 deployments; parse the authority with urlsplit(...).hostname instead.
Useful? React with 👍 / 👎.
2 participants
Add update_check module with tests, email_outbox retention tests, and LLM config tests. Refine billing, config, service, app, dashboard_app, mcp_server, v2_api, license_cloud, llm/client, email_outbox, and inspector. Update dashboard UI (css/js/index.html), conftest, and .env.example.
Description
Type
Verification
python -m pytest tests/ -qpassesruff check .passespython -m eval.harness --dataset eval/datasets/sample.jsonl --k 5passes